KVM: arm64: nv: Initialize hw_mmu to NULL for nested vCPUs

Before commit 6ded46b5a4fd ("KVM: arm64: nv: Keep reference on stage-2 MMU when scheduled out"), kvm_vcpu_load_hw_mmu() would set ->hw_mmu on every load. Now it only sets it when it is set to NULL.

In kvm_vcpu_init_nested() the vcpu->arch.hw_mmu points to &kvm->arch.mmu from when it was set in kvm_arch_vcpu_create().

Normally what happens next is a two step process. KVM_ARM_VCPU_INIT calls kvm_reset_vcpu_core() and that sets the vcpu into hyp context (vEL2). Then KVM_RUN calls kvm_vcpu_load_hw_mmu() which doesn't do anything. But that is fine because we are in hyp context and the ->hw_mmu already is pointing to the correct place.

However if, for example, we are restoring a vcpu that was saved in L2 context, then the VMM uses KVM_SET_ONE_REG to overwrite the vEL2 state that kvm_reset_vcpu_core() set up, and the vCPU is in L2 context when KVM_RUN loads it for the first time. Ideally, kvm_vcpu_load_hw_mmu() would set the hw_mm to point to L2's page tables but, since is non-NULL, it leaves it as is. At this point L2 can access L1's memory.

Fix this bug but setting ->hw_mmu to NULL in kvm_vcpu_init_nested() so that kvm_vcpu_load_hw_mmu() always sets it correctly on the first load.

---
 arch/arm64/kvm/nested.c | 2 ++
 1 file changed, 2 insertions(+)

index 78fa433774c6..60bccb66e52c 100644
@@ -140,6 +140,8 @@ int kvm_vcpu_init_nested(struct kvm_vcpu *vcpu)
 		kvm->arch.nested_mmus_size += S2_MMU_PER_VCPU;
 	}
 
+	vcpu->arch.hw_mmu = NULL;
+
 	return 0;
 }
 

2.53.0